RockteMQ-AI commented on issue #11446:
URL: https://github.com/apache/rocketmq/issues/11446#issuecomment-6212101882
**Issue Evaluation**
Category: `type/bug` | Status: **Confirmed**
The reported issue has been verified against the current codebase.
**Root Cause:** `StringUtils.trim()` is applied to the password parameter in
both `CreateUserSubCommand.java:81` and `UpdateUserSubCommand.java:86` before
the value is sent to the admin API. A secret is a payload, not a field name —
leading/trailing whitespace is part of a legal secret.
**Impact:** Users who set passwords with leading/trailing whitespace via
`mqadmin createUser`/`updateUser` will have the stored secret silently differ
from what they typed, causing authentication failures with no diagnostic output.
**Severity:** Medium — affects ACL provisioning through the CLI; the admin
API itself stores passwords verbatim.
**Fix scope:** Remove `trim()` only for the password field in both commands.
Keep `trim()` for username, userType, userStatus, broker address, and cluster
name. Null-safety note: in `UpdateUserSubCommand`, `-p` is optional, so
`commandLine.getOptionValue('p')` returns `null` when absent — the fix must
preserve this pass-through.
An automated fix proposal will be generated. Reply `/approve` to proceed
with PR generation.
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
